DECNET BEHAVE

Behavioral observation spec for adversarial network attribution. BEHAVE defines a structured observation envelope (core) and two domain registries — shell-session (BEHAVE-SHELL) and text/messaging (BEHAVE-TEXT) — used to build behavioral signatures over collected operator activity.

Packages

Package	Description	Path
decnet-behave-core	Shared observation envelope — schema contract used by all registries	core/
decnet-behave-shell	Shell-session behavioral observation registry	BEHAVE-SHELL/
decnet-behave-text	Text/messaging-domain behavioral observation registry	BEHAVE-TEXT/

Install

Each package is independently installable. Install core first as both registries depend on it.

pip install -e core/
pip install -e BEHAVE-SHELL/
pip install -e BEHAVE-TEXT/

For development (includes pytest + ruff):

pip install -e "core/[dev]"
pip install -e "BEHAVE-SHELL/[dev]"
pip install -e "BEHAVE-TEXT/[dev]"

Test

pytest core/
pytest BEHAVE-SHELL/
pytest BEHAVE-TEXT/

Licensing

This repository uses a dual license:

Content	License
Code, JSON schemas, tests (*.py, *.json, pyproject.toml)	GNU GPL v3.0 or later
Spec prose and attribution recipes (*.md files)	CC-BY-SA-4.0

SPDX identifiers are present in individual files.